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ABSTRACT 

Large-scale  simulations  often  involve  huge  numbers  of 
parameters,  making  it  prohibitive  to  run  more  than  a  tiny 
fraction  of  all  potentially  relevant  cases.  Sensitivity  analy¬ 
sis  attempts  to  show  how  sensitive  the  results  of  a  simula¬ 
tion  are  to  changes  in  its  parameters;  this  is  an  important 
tool  for  promoting  confidence  in  a  simulation  and  making 
its  results  credible.  However,  the  computational  cost  of 
traditional  approaches  to  sensitivity  analysis  prevents  its 
use  in  many  cases.  We  show  that  this  cost  is  logically 
unnecessary  and  can  be  largely  avoided  by  propagating 
and  combining  sensitivities  during  a  computation,  rather 
than  recomputing  them.  We  describe  this  “propagative" 
approach  to  sensitivity  analysis  and  present  the  algorithm 
we  have  implemented  to  explore  its  potential. 

1.  Overview 

A  simulation  can  be  viewed  as  a  single  top-level  function, 
which  may  have  thousands  or  even  tens  of  thousands  of 
parameters.  It  is  generally  prohibitive  to  run  such  a  simu¬ 
lation  (i.e.,  evaluate  this  function,  for  more  than  a  tiny 
fraction  of  all  possible  combinations  of  parameter  values. 
Simulations  are  therefore  typically  run  for  relatively  few 
cases,  representing  the  most  important,  likely,  or  promis¬ 
ing  of  these  parameter  values.  Sensitivity  analysis 
attempts  to  show  how  sensitive  the  results  of  a  simulation 
are  to  varying  the  values  of  its  parameters.  Since  exhaus- 


*This  research  was  sponsored  by  the  Defense  Advanced 
Research  Projects  Agency  (DARPA)  under  the  auspices  of 
RAND's  National  Defense  Research  Institute,  a  Federally 
Funded  Research  and  Development  Center  sponsored  by  the 
Office  of  the  Secretary  of  Defense,  under  contract  No. 
MDA903-85-C-0030.  Views  and  conclusions  contained  in 
this  document  are  those  of  the  authors  and  should  not  be 
interpreted  as  representing  the  official  opinion  of  DARPA, 
the  U.S.  government,  or  any  person  or  agency  connected 
with  them. 


live  evaluation  of  a  simulation  for  ail  cases  is  tarely  possi¬ 
ble,  sensitivity  analysis  is  especially  important  for 
promoting  confidence  in  the  “robustness”  of  a  model  (i.e., 
showing  that  its  results  are  independent  of  minor  changes 
to  its  parameters)  and  for  indicating  which  parameter 
values  are  the  most  important  ones  to  validate  in  order  to 
make  the  model  believable  [3],  [4], 

The  simplest  approach  to  sensitivity  analysis,  which  we 
refer  to  as  “naive  perturbation”,  requires  running  a  simula¬ 
tion  many  times,  while  perturbing  individual  parameters 
to  see  how  the  results  differ.  The  computational  cost  of  this 
process  is  prohibitive  for  all  but  the  most  trivial  simula¬ 
tions,  which  is  why  sensitivity  analysis  is  rarely  performed 
in  simulation.  Furthermore,  faster  computers  do  not  solve 
this  problem,  since  their  increased  capacity  is  invariably 
used  to  build  bigger  and  more  elaborate  models  rather  than 
to  perform  sensitivity  analysis  on  existing  models.  An 
alternative  approach  to  sensitivity  analysis,  called  Pertur¬ 
bation  Analysis  [6],  [7],  applies  wily  to  certain  kinds  of 
simulation  and  requires  substantial  mathematical  knowl¬ 
edge  about  the  process  being  simulated.  The  inability  to 
perform  sensitivity  analysis  cost-effectively  for  arbitrary 
simulations  therefore  remains  an  ongoing  and  critical 
impediment  to  the  acceptance  of  these  models  as  credible 
planning  and  decision  aids.  This  paper  describes  research 
on  a  computationally  feasible  way  of  performing  sensitiv¬ 
ity  analysis  in  a  simulation  context  [$]. 

2.  Background 

Consider  the  abstraction  of  a  simulation  shown  in 
Figure  1,  where  a  top  level  function,  Sim,  invokes  many 
levels  of  nested  subfunctions/  each  of  which  may  be 
called  many  times.  In  most  cases  of  practical  interest,  the 


tLi  this  discussion,  the  term  ‘‘subfunction”  is  used  to  mean  a 
function  that  is  called  by  another  function,  whether  or  not  it 
is  defined  within  the  lexical  scope  of  its  caller. 


Reprinted  from  Al,  Simulation  and  Planning  in  High  Autonomy  Systems,  Bernard  Zeigler,  Jerzy  Rozenblit  (eda.),  March  26-27,  1990, 
pp.  10-16,  ©  1990  IEEE  Computer  Society  Press.  Reprinted  by  permission. 
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function  Sim  will  have  a  large  number  of  parameters 
pk  (k  =  1  ,..,N)  relative  to  the  number  of  parameters  of  most 
of  its  subfunctions.  The  naive  perturbation  approach  to 
sensitivity  analysis  attempts  to  approximate  a  local  partial 
derivative  for  each  parameter  pk  by  perturbing  pk  in  the 
neighborhood  of  its  value  at  some  point  of  interest, 
P~{pk).  The  usual  way  to  approximate  the  partial 
derivative  would  be  to  compute  the  Cauchy  ratio: 

Sim(P\ . Pk  +  ±  -..PN)  - Sim(pv....pN )  wh_ch 

A 

convenience  we  wili  write  (Sim(P+Ak)  -  Sim(P))/Ak.  This 
approach  will  execute  Sim  once  to  compute  Sim(P )  plus 
one  or  more  times  for  each  parameter  pk,  each  time 
executing  each  subfunction  as  many  times  as  it  is  called. 
Each  subfunction /will  therefore  be  executed  on  the  order 
of  N  times,  where  N  is  the  number  of  parameters  of  Sim 
(the  exact  number  of  times / will  be  executed  is  a  function 
of  the  number  of  times  a  single  parameter  must  be 
perturbed  in  order  to  approximate  a  partial  derivative  and 
the  number  of  times/is  invoked  by  Sim). 

Now  consider  some  subfunction  g(gt . gn)  of  Sim  that 

has  many  fewer  parameters  than  N  (i.e.,  n«N).  Assuming 
that  g  is  reasonably  well-behaved,  finding  its  sensitivity  to 
variations  in  its  parameters  should  not  require  anywhere 
near  N  evaluations:  g  is  simply  not  complicated  enough  to 
warrant  this  much  expenditure  of  effort!  In  fact,  it  should 
be  possible  to  fully  characterize  the  sensitivity  of  g  by 
evaluating  it  on  the  order  of  n  (rather  than  N)  times,  result¬ 
ing  in  a  tremendous  performance  improvement  Similarly, 
if  g  calls  q(qi.-qj.  where  q  has  many  fewer  parameters 
than  g  (i.e.,  m«n«N),  then  this  improvement  can  be 


reaped  recursively.  Furthermore,  in  some  cases  the  sensi¬ 
tivity  of  a  given  subfunction  may  be  known  in  detail  from 
analytic  knowledge:  for  example,  the  sine  function  shown 
in  Figure  1  should  not  require  perturbation  at  all,  since  its 
derivative  is  known. 

In  general  then,  naive  perturbation  wastes  considerable 
effort  in  computing  the  sensitivities  of  the  subfunctions  of 
Sim.  This  observation  forms  the  basis  for  the  approach  to 
sensitivity  analysis  proposed  below. 

3.  A  new  approach  to  sensitivity  analysis 

We  have  designed  a  new  propagative  approach  to  sensi¬ 
tivity  analysis  that  propagates  and  combines  the  sensitivi¬ 
ties  of  functions  during  a  computation.  This  is  based  on  the 
observation  that  it  is  possible  to  compute  a  function’s  sen¬ 
sitivity  as  part  of  the  process  of  computing  its  value  [2],  The 
approach  is  motivated  by  the  chain  rule  of  the  differential 
calculus,  which  defines  the  partial  derivative  of  a  compos¬ 
ite  function  as  a  combination  of  the  partial  derivatives  of 
its  subfunctions  (assuming  these  subfunctions  are  differen¬ 
tiable  with  respect  to  the  parameters  of  interest).  The  chain 
rule  justifies  the  “propagation”  of  sensitivity  information  in 
the  sense  that  the  sensitivity  of  a  function/(i.e.,  its  partial 
derivatives)  in  a  given  neighborhood  can  be  used  to 
approximate  the  value  of/in  that  neighborhood.  A  geomet¬ 
ric  interpretation  of  this  process  for  a  function  g(x)  of  one 
parameter,  is  that  the  partial  derivative  g'of  g  in  the  neigh¬ 
borhood  of  a  point  xo  represents  the  slope  of  g  at  xp,  which 
can  be  used  to  approximate  the  value  of  g(%+A)  by  means 
of  the  linear  approximation  g(xc+A)  =  g(xp)+g'(x0)A. 

Our  propagative  approach  computes  a  representation  of 
the  sensitivity  of  each  subfunction  the  first  time  it  is  exe¬ 
cuted  and  propagates  that  sensitivity  information  (in  the 
above  sense)  rather  than  recomputing  it  each  time  it  is 
needed.  In  cases  where  a  subfunction’s  partial  derivatives 
are  known  analytically,  they  can  be  declared  as  part  of  its 
definition,  providing  a  direct  representation  of  its  sensitiv¬ 
ity.  In  general,  however,  a  numerical  approximation  to  a 
subfunction’s  partial  derivatives  must  be  computed,  for 
example  by  making  it  perturb  itself  once  for  each  of  its 
own  parameters*  This  approach  is  applied  recursively  to 
the  subfunctions  of  each  subfunction;  any  subfunction  that 


•Note  that  for  simplicity,  this  paper  focuses  on  sensitivity 
analysis  in  which  one  parameter  at  a  time  is  varied,  though 
the  propagative  approach  applies  equally  well  (and  has  even 
greater  potential  payoff)  when  combinations  of  parameters 
are  varied  together  (i.e.,  when  higher-order  partial 
derivatives  are  required). 
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has  more  parameters  than  its  caller  will  not  benefit  from 
[his  propagative  approach  and  so  is  simply  handled  as  in 
naive  perturbation. 

Conceptually,  the  approach  proceeds  as  follows.  In  order 
to  compute  the  sensitivity  of  Sim,  each  of  its  parameters  pk 
is  perturbed  in  turn  (as  in  naive  perturbation)  to  compute 
the  Cauchy  ratios  (SimiP+A^  -  Sim(P))/Ak,  for  all  k.  In  the 
process  of  evaluating  Sim  during  these  perturbations,  the 
first  time  a  particular  subfunction  /  is  called,  make  / 
compute  its  own  sensitivity  (by  repeating  this  process 
recursively)*  and  return  this  information  to  Sim  along  with 
its  normal  return  value.  For  all  subsequent  calls  to/ during 
the  perturbation  of  Sim’s  parameters,  Sim  uses  the  sensitiv¬ 
ity  information  returned  by  /  to  approximate  the  value  of  / 
instead  of  re-executing  it.  This  process  is  described  in 
further  detail  in  Section  5. 

Our  initial  attempt  to  analyze  the  expected  payoff  of  this 
approach  resulted  in  a  program  that  performed  symbolic 
analyses  of  computations  to  evaluate  the  advantages  of  the 
new  approach.  We  soon  realized,  however,  that  this  payoff 
analysis  was  even  more  computationally  intensive  than  the 
sensitivity  analysis  it  was  attempting  to  analyze!  It  became 
clear  that  it  would  be  more  efficient  to  analyze  the  payoff 
by  actually  implementing  a  propagative  environment  and 
using  it  to  perform  sensitivity  analysis  while  collecting 
performance  statistics.  We  therefore  next  implemented  a 
novel,  stand-alone  computational  environment  (in  LISP) 
to  support  the  propagation  and  combination  of  sensitivi¬ 
ties.  This  environment  has  allowed  us  to  try  our  approach 
on  a  number  of  computations  and  to  analyze  its  payoff. 

Although  the  purely-applicative  nature  of  LISP  lends  itself 
reasonably  well  to  the  propagative  approach  (since  every 
function  consists  simply  of  subfunction  calls),  the 
approach  would  work  equally  well  in  a  procedural  lan¬ 
guage,  where  subfunction  calls  are  embedded  in  a  sea  of 
in-line  computation.  In  addition,  not  all  functions  in  a 
given  computation  are  of  interest  for  sensitivity  analysis: 
for  example,  it  may  not  make  sense  to  analyze  the  sensi¬ 
tivity  of  built-in  functions  (such  as  the  LISP  conditional 
function  “cond”).  Our  computational  environment  there¬ 
fore  allows  the  user  to  designate  which  functions  are  “can¬ 
didates"  to  be  analyzed;  these  functions  are  automatically 
instrumented  by  the  environment  to  keep  track  of  how 
often  they  are  called.  The  user  further  identifies  whether 
candidate  functions  have  return  values  that  are  discrete  or 


•Though  it  is  an  important  issue,  we  defer  to  a  later  paper  the 
question  of  how  to  choose  an  appropriate  value  of  A  for  each 
perturbation. 


continuous  (though  this  could  be  done  automatically).  The 
environment  then  automatically  modifies  each  candidate 
function  to  return  a  representation  of  its  sensitivity  as  well 
as  its  normal  return  value. 


4.  Locality  and  “occurrences”  of  functions 

The  description  of  the  propagative  approach  presented  so 
far  ignores  one  major  problem  by  implying  that  a  given 
subfunction /has  the  same  sensitivity  each  time  it  is  called. 
This  may  be  true  for  functions  whose  actual  partial  deriv¬ 
atives  are  known  analytically,  but  in  general  the  sensitivity 
information  returned  by  a  function  cannot  be  assumed  to 
represent  more  than  a  local,  numerical  approximation  to 
its  partial  derivatives  in  the  neighborhood  of  its  invoca¬ 
tion.  To  properly  reflect  this  locality  assumption,  we  intro¬ 
duce  a  novel  concept,  which  we  call  an  “occurrence”  of  a 
function.  Consider  the  procedural  pseudo-code  shown  in 
Figure  2,  in  which  Function  FI  appears  twice  in  function 
H  and  F2  appears  five  times.  During  a  single  invocation  of 
H,  FI  will  be  evaluated  twice,  once  with  argument  Z  and 
once  with  argument  r.  We  say  that  there  are  two  “occur¬ 
rences”  of  FI  in  H  (labelled  FI :  1  and  Fl:2  in  Figure  2).  In 
the  absence  of  further  information  about  Z,  r,  and  FI ,  these 
two  occurrences  must  be  assumed  to  have  entirely  inde¬ 
pendent  sensitivities,  since  Z  and  r  may  represent  quite  dif¬ 
ferent  neighborhoods  of  the  domain  of  FI .  The  sensitivity 
of  each  occurrence  of  FI  must  therefore  be  computed  sep¬ 
arately,  as  if  each  occurrence  were  a  distinct  function;  the 
sensitivity  information  for  each  occurrence  of  FI  (as  well 
as  for  every  other  occurrence  of  every  subfunction  called 
by  H)  is  stored  in  an  “approximation  table”  in  H. 


FUNCTION  H(A3 . X.Y.Z) 

BEGIN 


F2:l 


\Fl.l\ - ►  F1(Z);  J 

q  :=  F2(A,B); ^ - 

n  :=  F2(X,  F2(Y,Z)); 

[771] - ►  Fl(r);  - - - \p2  3 


F2:2\ 

|FJ:/.  n| 

/ 


FOR  i  :=  1  TO  n  DO  r  :=  r  +  F'J(i); 
IF  Condition  THEN  q  :=  F2(  A.B); 
s  :=  F2(Y+A,  Z+A); 

\ — \ 


w 


F2:4  or  5? 


END 


Figure  2:  Occurrences  of  functions 


odes 


or 


l/H 


□  □ 


If  H  now  invokes  itself  again  with  one  of  its  parameters 
perturbed,  each  occurrence  of  FI  will  remain  in  the  same 
neighborhood  of  its  domain  (assuming  that  the  value  of  r 
is  a  continuous  function  of  the  parameters  of  H),  so  that  the 
sensitivities  previously  computed  for  FI:  1  and  Fl:2 
(which  were  saved  by  H  in  its  approximation  table)  should 
serve  as  valid  approximations  for  these  occurrences  of  FI 
in  the  new,  perturbed  invocation  of  H. 

Note  that  this  concept  of  an  occurrence  of  a  function  lies 
somewhere  between  an  invocation  and  a  lexical  appear¬ 
ance.  It  is  less  dynamic  than  an  invocation,  in  that  there  is 
a  strong  association  between  the  occurrence  FI:  1  during 
the  first  invocation  of  H  and  the  corresponding  occurrence 
Fill  during  the  second,  perturbed  invocation  of  H;  this 
association  allows  the  sensitivity  computed  for  FI :  1 
during  the  first  invocation  of  H  to  be  used  to  approximate 
the  value  of  FI:  1  during  the  second,  perturbed  invocation 
of  H.  In  addition,  an  occurrence  is  relative  to  the  calling 
function  (H),  whereas  an  invocation  of  a  function  is  gener¬ 
ally  independent  of  its  caller.  (Note,  for  example,  that 
calling  a  recursive  function  represents  only  a  single  occur¬ 
rence  in  the  caller.) 

An  occurrence  is  more  dynamic  than  a  lexical  appearance 
of  a  function,  as  illustrated  by  other  functions  in  Figure  2. 
For  example,  F2  appears  five  times  in  H,  but  it  may  only 
occur  4  times  during  a  given  invocation  of  H,  depending 
on  the  conditional  test.  Similarly,  the  number  of  occur¬ 
rences  of  F3  depends  on  the  dynamic  upper  limit  of  the 
FOR  loop.  Note  that  a  given  flow  of  control  through  H 
results  in  a  particular  set  of  occurrences  of  its  subfunc¬ 
tions.  To  summarize,  an  occurrence  of  a  function  F  in  H 
corresponds  to  an  invocation  of  F  in  a  particular  neighbor¬ 
hood  of  its  domain,  during  the  execution  of  a  particular 
flow  of  control  through  H.  To  our  knowledge,  this  concept 
is  not  supported  by  any  programming  language,  including 
LISP  and  Prolog. 

The  occurrence  defines  the  temporal  scope  of  the  sensitiv¬ 
ity  information  for  a  function.  That  is,  the  sensitivity  infor¬ 
mation  for  a  given  occurrence  of  a  function  F  in  H  must 
persist  from  the  time  that  H  first  invokes  F  to  compute  F’s 
sensitivity  through  the  subsequent  invocations  of  F  by  H 
that  use  this  sensitivity  information  to  approximate  F.  This 
information  cannot  be  stored  in  any  single  invocation  of  F 
(since  it  must  persist  across  several  such  invocations),  nor 
can  it  be  stored  as  "own”  information  of  F  (since  it  must 
be  associated  with  a  particular  flow  of  control  through  a 
particular  calling  function,  H).  The  sensitivity  information 
for  a  given  occurrence  of  F  must  therefore  be  stored  in  the 
corresponding  invocation  of  H  (in  the  approximation  table 


of  H,  as  described  above).  Furthermore,  this  invocation  of 
H  must  itself  persist  throughout  the  temporal  scope  of  all 
occurences  of  its  subfunctions;  that  is,  the  initial  evalua¬ 
tion  of  H  and  its  subsequent  perturbations  must  all  be  part 
of  a  single  invocation  of  H.  This  motivates  the  algorithm 
described  in  the  next  Section. 

5.  An  algorithm  for  the  propagative  approach 

Whenever  a  candidate  function  is  called  normally  during  a 
computation  (which  we  refer  to  as  a  “primary”  call),  our 
environment  first  causes  the  function  to  compute  its 
normal  return  value  and  then  causes  it  to  place  recursive 
“secondary”  calls  to  itself,  perturbing  each  of  its  argu¬ 
ments  in  turn.  By  so  doing,  the  function  computes  its  sen¬ 
sitivity  and  returns  this  information  to  its  caller  (along 
with  its  normal  return  value).  During  these  secondary  calls 
to  itself,  the  function  approximates  the  return  values  of  its 
candidate  subfunctions,  rather  than  recomputing  them  for 
each  secondary  call.  The  default  approximation  technique 
is  to  apply  the  sensitivity  of  each  called  subfunction  as  a 
linear  approximation  of  its  value  (where  the  sensitivity  of 
each  subfunction  is  computed  recursively  by  this  same 
process  and  returned  to  its  caller).  This  process  hinges  on 
the  notions  of  primary  and  secondary  calls,  which  we  illus¬ 
trate  with  a  simple  example,  shown  in  Figure  3. 

Consider  a  top-level  function  H  that  calls  a  candidate  func¬ 
tion  F,  which  in  mm  calls  another  candidate  subfunction 
G.  For  simplicity,  suppose  that  there  is  only  a  single  occur¬ 
rence  of  G  in  F,  that  F  calls  no  other  candidate  subfunc¬ 
tions  besides  G,  and  that  G  calls  no  candidate  subfunctions 
at  all.  Further,  suppose  both  F  and  G  are  continuous¬ 
valued,  differentiable  functions.  Since  F  is  a  candidate 
function,  the  propagative  environment  automatically 
interprets  H’s  call  to  F  as  a  primary  call  (shown  as 
“poll”).  Upon  receiving  this  primary  call,  F  initializes  its 
approximation  table  and  proceeds  to  compute  its  normal 
return  value,  calling  G  in  the  process.  Since  G  is  also  a 
candidate  function,  the  environment  interprets  this  as  a 
primary  call  as  well.  Upon  receiving  this  primary  call,  G 
proceeds  to  compute  its  normal  return  value  (since  G  calls 
no  candidate  subfunctions,  it  does  not  need  to  create  an 
approximation  table).  Having  computed  its  value — and 
before  returning  from  its  primary  call — G  must  compute 
its  sensitivity,  to  be  returned  to  F  along  with  G’s  value. 

To  compute  its  sensitivity,  G  perturbs  each  of  its  own 
arguments  in  turn,  placing  a  recursive  secondary  call 
(shown  as  "s-call”)  to  itself  for  each  perturbation.  For 
example,  if  G  has  only  a  single  formal  argument,  whose 


alue  (as  supplied  in  F’s  primary  call  to  G)  is  X,  then  G 
/ill  place  a  secondary  call  to  itself  with  an  argument  of 
¥+A),  where  A  provides  the  perturbation.  This  recursive 
econdary  call  to  G  returns  the  value  G(X+A)  to  the 
rimary  invocation  of  G.  Assuming,  for  simplicity  of 
xposition,  that  a  single  perturbation  is  enough  to  produce 
linear  approximation  to  its  “partial”  derivative,  G 
omputes  the  Cauchy  ratio  (G(X+A)  -  G(X))/A  as  its 
ensitivity  information  (shown  as  “s(G)”),  and  returns  this 
3  F  along  with  G’s  normal  return  value  (shown  as 
g(X)”).  The  value  of  the  Cauchy  ratio  represents  the 
ensitivity  of  G  to  its  argument  (in  the  neighborhood  of  the 
oint  X);  this  is  used  subsequently  by  F  as  a  linear 
pproximation  to  the  value  of  G.  If  G  had  several 
rguments,  it  would  perturb  each  one,  generating 
econdary  calls  to  itself  to  compute  a  Cauchy  ratio  for  each 
tartial  derivative,  and  would  return  the  collection  of  the 
esulting  coefficients  as  its  sensitivity  information. 

Vhen  the  primary  call  to  G  returns  to  F,  F  separates  the 
eturn  value  g(X)  from  the  sensitivity  information  s(G), 
vhich  it  stores  as  its  approximation  table  entry  for  this 
xxurrencc  of  G.  F  continues  executing  its  own  primary 
all  (from  H),  using  the  value  g(X)  as  needed  to  compute 
ts  own  return  value.  Having  computed  its  value  (and 
jefore  returning  from  its  primary  call),  F  computes  its  sen- 
sitivity  (to  be  returned  to  H  along  with  F's  value,  as  the 
•esult  of  H’s  primary  call  to  F).  To  compute  its  sensitivity, 
F  perturbs  each  of  its  own  arguments  in  turn,  placing  a 
recursive  secondary  call  to  itself  for  each  perturbation. 
The  results  of  these  recursive  secondary  calls  are  used  to 
:ompute  the  Cauchy  ratios  for  F’s  own  partials,  as  was 
lone  for  G.  However,  during  these  secondary  calls,  when- 
;vcr  F  would  normally  call  G,  it  now  “places  secondary 
:alls  to  G”,  by  which  we  mean  that  it  uses  its  approxima- 
ion  table  entry  for  G  to  approximate  the  value  of  G  rather 
ihan  actually  calling  G.  The  environment  ensures  that  the 
ipproximation  table  that  F  constructed  during  its  primary 
:all  is  available  for  use  by  these  secondary,  recursive  inve¬ 
ntions  of  F. 

To  summarize,  a  primary  call  to  a  candidate  function  F 
:alculates  its  normal  return  value,  in  the  course  of  which  it 
>laces  primary  calls  to  its  candidate  subfunctions,  each  of 
vhich  returns  its  sensitivity  as  well  as  its  normal  return 
nlue.  The  calling  function  F  stores  this  sensitivity  infor- 
nation  in  an  approximation  table  for  later  use.  The 
irimary  call  then  initiates  a  series  of  recursive  secondary 
alls  by  F  to  itself,  to  compute  its  sensitivity  by  perturbing 
ts  parameters.  During  these  secondary  calls,  the  value  of 
ach  candidate  subfunction  is  approximated  using  the  sen- 
itivity  information  previously  stored  in  F’s  approxima¬ 


tion  table  entry  for  that  subfunction.  It  is  the  ability  to 
approximate  these  return  values  (rather  than  recomputing 
them)  that  allows  the  propagative  approach  to  outperform 
naive  perturbation.  When  F  has  completed  perturbing  its 
parameters  via  recursive  secondary  calls,  it  will  have 
derived  its  own  sensitivity  to  its  parameters:  This  informa¬ 
tion  is  returned  by  F  to  its  caller  to  serve  as  F’s  entry  in  its 
caller’s  approximation  table. 

A  secondary  call  by  a  function  F  to  a  candidate  subfunc¬ 
tion  G  essentially  replaces  the  evaluation  of  G  with  an 
approximation,  using  the  entry  for  G  in  F’s  approximation 
table  (which  was  returned  to  F  by  G,  when  F  placed  its 
primary  call  to  G). 

One  final  point  is  that  the  flow  of  control  through  H  must 
not  change  when  it  perturbs  its  parameters.  This  would 
invalidate  the  locality  assumption  (that  secondary  calls 
occur  in  the  same  neighborhood  as  their  corresponding 
primary  call),  which  justifies  the  use  of  approximations  for 
subfunctions  during  secondary  calls.  In  order  to  guard 
against  this,  an  “occurrence-counter”  counts  subfunction 
occurrences  during  the  primary  call  of  H  and  records  the 
value  of  the  counter  in  the  approximation  table  entry  for 
each  occurrence.  During  a  secondary  call  of  H,  if  the 
stored  value  for  a  particular  subfunction  occurrence  does 
not  match  the  dynamic  value  of  the  occurrence-counter  or 
the  parameter  values  for  the  call  are  not  within  the  same 
neighborhood,  then  the  control  flow  for  this  secondary  call 
has  deviated  from  that  of  the  corresponding  primary  call; 
in  this  case  the  environment  reports  that  the  locality 
assumption  has  been  violated. 

6.  Results 

Our  initial  results  indicate  that  this  propagative  approach 
has  tremendous  potential,  reducing  a  combinatorial 
process  to  a  linear  one.  In  addition,  we  note  that  the 
approach  has  implications  beyond  sensitivity  analysis:  it 
suggests  a  novel  computational  paradigm  in  which  func¬ 
tions  replace  themselves  by  approximations  when  they  are 
first  called,  and  these  approximations  are  used  for  the 
remainder  of  a  computation,  e.g.,  to  improve  performance. 
Sensitivity  analysis  is  simply  one  instance  of  this 
approach,  using  linear  approximations  based  on  partial 
derivatives:  however,  the  approach — and  the  computa¬ 
tional  environment  we  have  implemented — allow  arbi¬ 
trary  approximations  to  be  used. 

Ultimately,  we  would  like  our  environment  to  support 
standard,  procedural  languages  such  as  C  or  Ada.  This 


requires  modifying  a  compiler  or  building  a  preprocessor 
to  automatically  transform  user-supplied  functions  into  the 
form  required  by  our  propagative  algorithm,  with  a 
minimum  of  declarative  overnead  for  the  user.  In  addition, 
further  research  is  needed  before  this  approach  can  be  inte¬ 
grated  into  a  realistic  simulation  environment.  For 
example,  although  Boolean  derivatives  and  a  Boolean 
version  of  the  chain  rule  can  be  defined  [1],  the  general 
case  of  symbolic-valued  functions  requires  further 
thought.  Our  computational  environment  allows  functions 
of  this  sort,  but  only  applies  the  propagative  approach  to 
those  functions  that  are  differentiable  in  the  usual  sense, 
performing  naive  perturbation  for  all  others.  However, 
even  without  such  extensions,  we  believe  this  new 
approach  holds  great  promise  for  the  feasibility  of  sensi¬ 
tivity  analysis  in  simulation. 
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